[unfinite]

I foolishly encrypted a folder with Windows encryption. This was on an old computer and it is now dead; motherboard is fried, hard drives are still fine though. I have a new computer now, with much newer, but similar hardware.

Old: AMD Athlon XP (32-bit), MSI motherboard, Geforce 4
New: AMD Phenom II (64-bit), MSI motherboard, Geforce 9

I have the old hard drives in my new machine, so I can access all my old files, but I cant get into the encrypted folder, obviously. There isn't anything wrong with the Windows install, it's still there and I'd be able to boot into I if it was on the old hardware, but I'm not.

What I want to do is boot into my old XP install on my new hardware to recover these encrypted files. I've tried booting already, but it either bluescreens and restarts before starting windows, or it just restarts without a bluescreen. The hardware is just too different.

Hopefully windows encryption doesn't use hardware IDs in it's decryption. I've already extracted all the encryption keys from the old system, but they're no use to me now, as far as I can tell.

What do I have to do to boot into my old operating system?

[fairnooks]

What was/is the hard drive controller situation? Is the old drive IDE and does the new have a native IDE channel or is this all SATA?

You need the certificates for the encryption but I don't know if you can export them from a non-booted system (have to read up on that).

Anyway if its IDE its a snap to change the IDE controller of the old mobo to a generic one with a UBCD4Win CD, which will allow the boot to go forward enough on an alien board to get up an runnning to be able to install all the other basic drivers to get a fully functioning OS again. For SATA I'm not sure what the procedure is.

[unfinite]

The old drive is IDE. I have it hooked up right now. At the moment I'm attempting to make an image of the drive and boot it up in Virtual PC.

[TheOutcaste]

Can the old drive boot to Safe Mode with Command Prompt? If so, you can use cipher.exe to either decrypt the files, or export the certificate so you can import it into a different system.
To Export:
cipher /X:EFSFilePath FileName
to Decrypt:
cipher /A /D /S:EFSFilePath

FileName is a file name without extensions, and EFSFilePath is an encrypted filepath.

You can also run MMC, and create a Certificates console to export the key as well.

One thing, I haven't been able to export a certificate without specifying a path to an encrypted file. Help says it's optional, but I haven't been able to do it without specifying the EFSFilePath.
See this article for more info on exporting certificates. It covers using the User State Migration Tool which doesn't apply here, but the parts on exporting a certificate are.

How to migrate EFS Files and Certificates.

Jerry

[unfinite]

Can the old drive boot to Safe Mode with Command Prompt?

No, I tried, It wouldn't boot into safe mode. I might have to boot into recovery mode with an xp disk and update the HAL file. That might mess it up for good though, so I'm trying to do it on a virtual machine where it cant hurt. I'm having a really hard time trying to make an image of my drive to boot from though.

Does anyone know of a way to make a .vhd image of a physical partition? WinImage will make vhds, but it doesn't detect the partition and will only make an image of the entire drive, which is way too big since the rest of the drive is storage. I'm trying to do this but at step 7 I'm lost. I can't find that anywhere.

[fairnooks]

Just by reading it, it sounds like it only does drives, not partitions. I have Acronis Workstation and I can make a .tib image and then convert that to a virtual install but since you're IDE, I'd make a UBCD4Win CD and run the IDE controller driver replacement utility from that and you're golden. Its never failed me and never ceases to make me joyous, since before I discovered the process all I had was crossed fingers!

[TheOutcaste]

Originally Posted by unfinite

I'm trying to do this but at step 7 I'm lost. I can't find that anywhere.

Haven't tried this myself, but run through the steps to create a New Virtual hard Drive. After you select a file name and location for the disk, the next screen has the option to link to an existing drive. Can only see the entire drive, and on mine I can't uncheck the read-only setting, as both drives have drive letters assigned. I didn't go beyond this point, so don't know anything about the converting process.

[unfinite]

I've never seen that option when creating the virtual disk, even using advanced options. Where exactly did you find the Wizard? How can I open that?

[TheOutcaste]

Here's the steps in VPC 2007, should be the same in VPC 2004
File | Virtual Disk Wizard
Click Next
Select Create a new virtual disk and click Next
Select A virtual hard disk and click Next
Click Browse, select a folder and type a name, click Save
Click Next
This gets you to the page shown in the first screen shot.
Select Linked to a hard disk (Advanced), you'll get a Pop up caution box, click OK, then click Next
This gets you to the Physical Hard Disks window shown in the second screen shot.

[unfinite]

Looks like they removed that feature from Windows Virtual PC. And 2007 isn't officially supported on Windows 7.
--
I managed to recover all my encrypted files! I found a piece of software that made it a breeze. (http://www.elcomsoft.com/aefsdr.html) I told it what drive, it searched it for encryption keys, then it asked for my username and password, searched for encrypted files, and returned everything I had encrypted. I got to pick which ones I wanted, it asked me where to decrypt them to, and it did all the work.

I can't believe how long I spent trying to get XP to boot when I could have just done it this way all along.

Thanks, everyone, for your help.

[TheOutcaste]

VPC 2007 isn't supported, but will work. I haven't tried the new Win 7 version of VPC yet.

I totally forgot about that elcomsoft utility. Saw it mentioned a few months ago on another forum. Is the trial version fully functional, or do you have to buy it to actually recover the files?

If your issue has been resolved you (and ONLY you) can mark this thread Solved by using the Mark Solved button at the Top Left of this thread (above the first post)



Jerry

[unfinite]

Originally Posted by TheOutcaste

I totally forgot about that elcomsoft utility. Saw it mentioned a few months ago on another forum. Is the trial version fully functional, or do you have to buy it to actually recover the files?

"An unregistered (trial) version of AEFSDR decrypts only first 512 bytes of all files, padding the rest of content with zeros (the source/encrypted files remain untouched)." You have to get the full version.